Case C‑291/24

Steiermärkische Bank und Sparkassen AG

and

Österreichische Finanzmarktaufsichtsbehörde (FMA)

(Request for a preliminary ruling from the Bundesverwaltungsgericht)

Judgment of the Court (Fourth Chamber) of 29 January 2026

(Reference for a preliminary ruling – Prevention of the use of the financial system for the purposes of money laundering or terrorist financing – Directive (EU) 2015/849 – Penalties – Article 58 – Liability of legal persons – Article 59 – Attribution to a legal person of an infringement of its obligations committed by natural persons – Conditions – Article 60)

Approximation of laws – Prevention of the use of the financial system for the purpose of money laundering and terrorist financing – Directive 2015/849 – Penalties – National legislation requiring that, in order to penalise a legal person, the formal status of accused person is first given to a natural person and that the operative part of the decision imposing a penalty refers to that natural person and to the fact that he or she committed an act constituting an offence which is attributable to the legal person – Not permissible

(European Parliament and Council Directive 2015/849, Arts 58(1) to (3), 59(1) and 60(5) and (6))

(see paragraphs 24-38, operative part)
Approximation of laws – Prevention of the use of the financial system for the purpose of money laundering and terrorist financing – Directive 2015/849 – National legislation providing for a limitation period of three years for bringing proceedings and of five years for imposing a penalty, from the date that the offence in question came to an end – Whether permissible

(see paragraphs 39-44, operative part)

Résumé

Having received a request for a preliminary ruling from the Bundesverwaltungsgericht (Federal Administrative Court, Austria), the Court of Justice provides clarifications on the conditions for the liability of a legal person under Directive 2015/849 ( 1 ) on combating money laundering and terrorist financing, when there is failure to comply with the relevant due diligence obligations.

On 29 February 2024, the Österreichische Finanzmarktaufsichtsbehörde (FMA) (Financial Market Authority (FMA), Austria) imposed a penalty, pursuant to Article 35(1) and (2) of the national law on anti-money-laundering, ( 2 ) on Steiermärkische Bank und Sparkassen on the ground that it had failed to comply with its due diligence obligations in respect of money laundering. KL and TR, two natural persons whose acts are attributable to Steiermärkische Bank und Sparkassen, are also parties to the main proceedings as accused persons.

Ruling on an action brought against that decision, the Federal Administrative Court, which is the referring court in the present reference for a preliminary ruling, classified that penalty as a ‘criminal administrative law’ penalty. The referring court notes that Article 35(1) of the Law on anti-money laundering introduced, as an additional condition for penalising a legal person, a ‘failure to comply with the obligations referred to in Paragraph 34(1) to (3)’ by a natural person for the benefit of that legal person. It adds that, according to the case-law of the Verwaltungsgerichtshof (Supreme Administrative Court, Austria), for a legal person to be penalised, it is necessary that, in the first place, the natural person whose actions are to be attributed to that legal person has first been a party to the proceedings in question and treated in that context not merely as a witness but as an accused person, with all the rights attached to that status. In the second place, it is necessary that the operative part of the decision imposing the penalty on that legal person finds that the unlawful and culpable act constituting an offence was committed by the duly identified natural person in question or legal representative of that legal person. In the third place, it is required that, in the operative part, that act is attributed to the legal person concerned.

In that context, the referring court asks whether those additional requirements set out in national law restrict the scope of Article 60(5) of Directive 2015/849 and, consequently whether the provisions of that directive preclude national legislation which lays down such requirements. In that regard, the referring court points to the judgment in Deutsche Wohnen, ( 3 ) in which the Court held that Regulation 2016/679 ( 4 ) must be interpreted as precluding national legislation under which an administrative fine may be imposed on a legal person in its capacity as a controller of personal data in respect of an infringement referred to in Article 83(4) to (6) of that regulation only in so far as that infringement has previously been attributed to an identified natural person.

Findings of the Court

As a preliminary point, the Court recalls that the main aim of Directive 2015/849 ( 5 ) is the prevention of the use of the financial system for the purposes of money laundering or terrorist financing. More specifically, it seeks to establish, taking a risk-based approach, a body of preventive and dissuasive measures to combat money laundering and terrorist financing effectively, in order to prevent flows of illicit money from being able to damage the integrity, stability and reputation of the financial sector and threaten the internal market of the European Union as well as international development. ( 6 ) That directive therefore applies to entities referred to as ‘obliged entities’, ( 7 ) which are credit institutions, financial institutions and certain natural or legal persons acting in the exercise of their professional activities. ( 8 )

As regards, more specifically, the penalties laid down in Article 59 of Directive 2015/849, which apply at least to breaches on the part of obliged entities that are serious, repeated, systematic or a combination thereof, the Court notes, in the first place, that Article 58(1) of that directive requires Member States to ensure that the obliged entities can be held liable for breaches of national provisions transposing that directive. It states that there is nothing in that provision to indicate that the liability of an obliged entity under that directive, where that entity is a legal person, may depend on the liability of a natural person under national law.

Where the obliged entity is a legal person, since such a person may act only through the intermediary of natural persons whose acts are attributable to that legal person, Directive 2015/849 merely introduces rules to clarify the conditions under which (i) breaches which entail the liability of a legal person must also be attributable to the natural persons who are responsible for them under national law and (ii) acts of certain natural persons can result in the liability of a legal person.

Accordingly, first, under Article 58(3) of that directive, Member States are to ensure that, where obligations apply to legal persons in the event of a breach of national provisions transposing that directive, sanctions and measures can be applied to the members of the management body and to other natural persons who under national law are responsible for that breach. It does not follow from that provision that the imposition of a penalty on a legal person as an obliged entity is subject to a previous finding that that breach in question was committed by a natural person. On the contrary, the liability of natural persons under national law is only ancillary and additional to the liability of the legal person concerned under Directive 2015/849.

Second, under Article 60(5) and (6) of Directive 2015/849, Member States are to ensure that a legal person can be held liable both for the breaches committed for their benefit by any person, acting individually or as part of an organ of that legal person and having a leading position within that legal person, and for where the lack of supervision or control by such a person has made it possible to commit breaches for the benefit of that legal person by a person under its authority.

Consequently, the Court finds that that provision merely refers to the natural persons whose acts or omissions, for the benefit of a legal person, may result in the liability of that legal person. However, it does not follow that the liability of those natural persons under national law must be incurred first or that those persons be identified in the operative part of the decision imposing a penalty on that legal person and identified as liable for the breach in question.

In the second place, the Court states that an interpretation of Articles 58 to 60 of Directive 2015/849 according to which the Member States may make the liability of a legal person subject to the prior finding that the breach was committed by a natural person would be contrary to the requirement laid down in Article 58(1) of that directive that any sanction or measure resulting from the liability of obliged entities for breaches of national provisions transposing that directive are to be effective, proportionate and dissuasive. Such a requirement would risk weakening the effectiveness and the deterrent effect of penalties directly imposed by Directive 2015/849 on legal persons as obliged entities.

Furthermore, the Court states, first, that while that directive carries out only a minimum harmonisation, the Member States cannot, however, limit the scope of the liability that Article 58(1) of that directive imposes on those obliged entities, including legal persons. In addition, while Article 59 of Directive 2015/849 leaves to the Member States the choice to lay down penalties and measures other than those listed in that article, the fact remains that the Member States must at least apply penalties in respect of the infringements referred to in that provision, committed by obliged entities, by laying down at the very least the penalties and administrative measures set out in Article 59(2) and (3).

Second, since the referring court states that the conditions for the liability of legal persons under national rules transposing Directive 2015/849 result from the case-law of the Supreme Administrative Court, the Court of Justice recalls that, according to its settled case-law, when national courts apply their domestic law they are bound to interpret it, so far as possible, in the light of the wording and purpose of the directive concerned in order to achieve the result sought by the directive and consequently comply with the third paragraph of Article 288 TFEU. This obligation to interpret national law in conformity with European Union law is inherent in the system of the FEU Treaty, since it permits national courts, for the matters within their jurisdiction, to ensure the full effectiveness of European Union law when they determine the disputes before them. That principle that national law must be interpreted in conformity with European Union law requires national courts to do whatever lies within their jurisdiction, taking the whole body of domestic law into consideration and applying the interpretative methods recognised by domestic law, with a view to ensuring that the directive in question is fully effective and achieving an outcome consistent with the objective pursued by it. ( 9 )

In the present case, the Court finds that it is therefore for the referring court to interpret the relevant provisions of the Law on anti-money laundering in a manner consistent with Directive 2015/849.

Consequently, the Court holds that Article 58(1) to (3), Article 59(1) and Article 60(5) and (6) of Directive 2015/849, read in the light of the principle of effectiveness, must be interpreted as precluding national legislation which requires that, in order to penalise a legal person, a natural person has first been given the formal status of an accused person and that the operative part of the decision imposing a penalty on that legal person refers to that natural person by name and states that that person committed an unlawful and culpable act constituting an offence which is attributable to that legal person.

( 1 ) Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC (OJ 2015 L 141, p. 73).

( 2 ) Finanzmarkt-Geldwäschegesetz (Law on financial markets anti-money laundering) of 26 July 2017 (BGBl. I, No 118/2016), in the version of 28 May 2021 (BGBl. I, No 17/2018) (‘the Law on anti-money laundering’).

( 3 ) Judgment of 5 December 2023, Deutsche Wohnen (C‑807/21, EU:C:2023:950).

( 4 ) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1).

( 5 ) As is apparent from the heading and Article 1(1) and (2) of Directive 2015/849.

( 6 ) Judgment of 19 June 2025, Lietuvos bankas (C‑671/23, EU:C:2025:457, paragraph 35 and the case-law cited).

( 7 ) Pursuant to Article 2(1) of Directive 2015/849.

( 8 ) They are referred to in point 3 of Article 2(1) of Directive 2015/849.

( 9 ) Judgment of 26 June 2025, Makeleio and Zougla (C‑555/23 and C‑556/23, EU:C:2025:484, paragraphs 85 and 86 and the case-law cited).